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UNCLASSIFIED 


FEDERAL BUREAU OF INVESTIGATION 


Precedences ROUTINE 

To: San Diego 

From: San Diego 

CYl 

Contact: SA 


Date: 12/01/2011 0 

V 


Approved By: | y *—*-- 

Drafted By: _ 

Case ID #: 288A-SD-NEW (Pending) 


Title: UNSUB(S); 

#ANTISEC; 

COMPUTER : 




VICTIM; 


Synopsis: Request case ce opened on captioned investigation. 

Details: On 11/18/2011, retired California Depar tment of Justice 

Special Agent Supervisor I I advised that he 

received text messages from his own Google telephone number 
indicating that he had been "owned". 

On 11/18/2011, a YouTube video was posted with the 
title "#AntiSec Fuck FBI Friday V - Cybercrime Investigator 
rnmmnn j ca 1 1 on r " from the YouTube user account 

I I - The video was 6:03 long and stated the 

following information, which was also posted as text below the 
video: 

"Greetings Pirates, and welcome to another exciting #FuckFBIFriday release. 

As part of our ongoing effort to expose and h umiliate our white hat enemies, we targeted a Special Agent Supervisor 
of the CA Department of Justice in charge of l I We are leaking over 38,000 private 

emails which contain detailed computer forensics techniques, investigation protocols as well as highly embarrassing 
personal information. We are confident these gifts will bring smiles to the faces of our black hat brothers and sisters 
(especially those who have been targeted by these scurvy dogs) while also making a mockery of "security 
professionals" who whore their "skills" to law enforcement to protect tyrannical corporativism and the status quo we 
aim to destroy. 
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UNCLASSIFIED 



To: San Diego From: San Diego 

Re: 2 8 8A-SD-NEW, 12/01/2011 


We hijacked two gmail accounts belonging to | | who has been a cop for i ly ears, dumping hi s private 

email correspondence as well as se veral dozen voice mails and SMS text message logs. While just yesterday f | 
was having a private BBQ with his l h igh computer crime task force friends, we were reviewing their 

detailed internal operation plans and proc edure d ocuments. We also couldn' t overlook the boatloads of embarrassing 
personal information about our cop friendl_| We lulzed as we listened to I I 


~|we turned on his google web history and watched him[ 


111JLW1 J U11U »T U LV11VU 1.AAAAA ^ 

We also abused his google voice account, making surd Ifriends 


and family knew how hard he was owned. Possibly the most interesting content in his emails are th< 


] 


I i The information in these emails will prove essential to 

those who want to protect themselves from the techniques and procedures cyber crime investigators use to build 
cases. If you have ever been bust ed for computer crimes, you should check to see if your case is being discussed 
here. There are discussions about] I 


These cybercrime investigators are supposed to be the cream of the crop, but we reveal the totality of their ignorance 
of all matters related to computer security. For months, we have owned several dozen white hat and law enforcement 
targets- getting in and out of whichever high profile government and corporate system we please and despite all the 
active FBI investigations and several billion dollars of funding, they have not been able to stop us or get anywhere 
near us. Even worse, they bust a few dozen people who are allegedly part of an "anonymous computer hacking 
conspiracy" but who have only used kindergarten-level - this isn't even hacking, but a form of electronic 

civil disobedience. 

We often hear these "professionals" preach about "full-disclosure," but we are sure these people are angrily sending 
out DMCA takedown notices and serving subpoenas as we speak. They call us criminals, script kiddies, and 
terrorists, but their entire livelihood depends on us, trying desperately to study our techniques and failing miserably 
at preventing future attacks. See we're cut from an entirely different kind of cloth. Corporate security professionals 
like Thomas Ryan and Aaron Barr think they're doing something noble by "leaking" the public email discussion lists 
of Occupy Wall Street and profiling the "leaders" of Anonymous. Wannabe player haters drop shitty dox and leak 
partial chat logs about other hackers, doing free work for law enforcement. Then you got people like Peiter "Mudge" 
Zatko who back in the day used to be old school lOpht/cDc only now to sell out to DARPA going around to hacker 
conventions encouraging others to work for the feds. Let this be a warning to aspiring white hat "hacker" sellouts and 
police collaborators: stay out the game or get owned and exposed. You want to keep mass arresting and brutalizing 
the 99%? We'll have to keep owning your boxes and torrenting your mail spools, plastering your personal 
information all over teh internets. 

Hackers, join us and rise up against our common oppressors - the white hats, the 1%’s ’private' police, the corrupt 
banks and corporations and make 2011 the year of leaks and revolutions! 

We are Anti-Security, 

We are the 99% 

We do not forgive. 

We do not forget. 

Expect Us!" 
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To: San Diego From: San Diego 

Re: 288A-SD-NEW, 12/01/2011 


A link was also prov ided on the YouTube 
documents that were taken from 
infnrmaHnn we a Inrahprl at_ 


account 


page to 
The 


the 


Additionally, some of the information contained withi n 
account was posted at 


On 11/30/2011, California Department of Justice 
pr nvided the fb t with a CD-ROM disc containing the files located 
at | These files are contained in a 1-A envelope to 

this fj1e and are password protected with the following password: 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE 

To: San Diego 

From: San Diego 

CYl 

Contact: SA 


Date: 12/05/2011 


Approved By: 
Drafted By: 
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Case ID #: 288A-SD-73148 (Pending) 


Title: UNSUB(S); 

ANT I SEC ; 


/ 



VICTIM; 


COMPUTER INTRUSION 


Gmail files from 


Synopsis: Document collection of 

I I 

Details: On 12/01/2011, following a determination that the CD- 

ROM disc obtained fr om the California Department of Justice had 


c 


become corrupted, SA 


visited the website 
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and downloaded the torrent 
containing the contents of the Gmail files exfiltrated from 
I accounts. The contents included one zipped file 


The zipped file was placed on a CD-ROM disc and placed 
in the 1-A file. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 12 / 07 / 2 011 

I d ate of birth I L social 

security account number l I was interviewed at the San 

Diego Division of the Federal Bure au of Inves tigati on. Also _ 

attending the interview were ITCFE \ . | and IA |_ 

After being advised of the i dentity of the interviewing Agent and 

the nature of the interview, _volunteered the following 

information: 

_ referred to the written statement he had 

previously submitted and advised that the information provided 
within was accurate. A copy of the written statement is contained 
in a 1-A envelope in the file. 

On 11/18/2011, at approximately 7:00 am PST, 
began receiving text messages on his cellular telephone fr om the 
telephone number associated with his Google Voice account, 

I I The text messages were statements similar to "We have 

you" and "aam azpu" . Additional text messages were received that 

directed |_|to enter an IRC chat room tn discuss the matter 

with thft individua1s that had taken over | _ accounts. 

_ advised that he did not reply to these messages and does 

not recall the exact context of the message s or the n ame of the IRC 
chat room that they were directing him to. I I stated that he 

has deleted the text messages and has no record of them. 

Shortly after receiving the text messages fro m the _ 

individuals claiming they had compromised his accounts, I 

began receiving telephone calls from friends and family members who 
advised him that they were receiving suspicious messages from him 

on Faceb ook. The individuals also advised that there were_ 

and other out of character posts on his Facebook feed. 

By noon_ had recovered and locked down all of his 

accounts. Text messages continued arriving on his cellular 
telephone that appeared to be from his Google Voice telephone 
number. Fearing that his Google account was still compromised, 
deleted the Google account. • 

Following the recovery of his accounts,!_| received 

a text message that stated that it wasn't over and a text message 
that made a reference to the tough economic times and financial 


Investigation on 


12/06/2011 at San Diego, CA 


File# 288A-SD-73148 


Date dictated 


by SA 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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288A-SD-73148 


Continuation of FD-302 of 


, On 12 / 06/2 011 , Page 


issues. | | checked his credit c ards and d iscovered that a 

fraudulent charge had been made on his i 1 card from Ritz _ 

camera. The item was set to_sh±Q_to his old address. The _ 

card that was used ended in 

_ believed that the compromise could be related to 

his Android cellular telephone, which he had "rooted". One of the 
consequences of rooting the telephone was that other programs that 
normally would not have access to the files "Shared Preferences" 
and "Accounts.db" c ould now access those files. The fil es contain 
information such as I I from the 

telephone. A few days prior to the in dividuals advising | 
that he had been compromised ! had downloaded and installed 

a program called "atorrent" from the Android store. This program 
allowed a n spr ho dow nload torrent files onto your cellular 
telephone. | stated that he used the program several times 

to test it, downloading music and a movie. 

| also stated that his laptop could have been a 
potential source of the compromise, but did not believe that it 
could have been his desktop computer. 

_The password used for his Gmail account, 

_ 1 . The only other system that 

\ All other 


A1though # AntiSec claimed to compromise two Gmail 
accounts, I b elieved t hat the second account compromised may 

have been his Yahoo! account,! I since he had to 

I I stated that he was 

unsure how the y would have determined that he was the owner of the 
Yahoo! account! 

| ' was unaware if the Gmail account 

he had create d fori had been compromised. 

Additionally, | did not remember the exact name of that 

account or the password for it. 

_ advised that he has wiped the hard drives of 

both his laptop and desktop computers. He also stated that he has 
deleted his Google account that was compromised and reset his 
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288A-SD-73148 


Continuation of FD-302 of 


, On 12/06/2011 , Page 


Android cellular telephone |_ 

all of the text messages he had received. 


which removed 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 01 / 05 / 2012 


On 12/31/2011, an individual posted information regarding- 
the compromise of the California State Law Enforcement Association 
(www.cslea.com) on www.pastebin.com. The information provided an 
explanation for the attack, e-mail communications from CSLEA 
personnel discussing the security of their website, as well as 
name, address, password, and credit card information for 
individuals related to CSLEA. Additionally, the me ssage stated 
that the compromise of CSLEA was "how Special Agent f 
at the California D0J | |Unit got humiliated last month". 


] 


he 

hie 


The referenced information has been printed out and 
attached to this document. 



investigation on 01/05/2012 at San Diego, CA 

File# 288A-SD-73148 ' 

- / ^ - - 

by SA _ 


Date dictated 


b6 

b7C 


This document contains neither recommendations nor conclusions of the FBI. 
it and its contents are not to be distributed outside your agency. 


It is the property of the FBI and is loaned to^ y our agency; 
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Hello comrades and thank^or joining us for the final phase of our cross count - Pastebin.com 

# w 

p A S T E B l N ! I' TOOL SINCE 200? CREATE NEW PASTE 


PASTED I M Follow©pastebin 


Oif.AI It l>fcV PASVfc 1 Ri NDiNCi PASI th 


TOOLS API ARfhlVF 


search... 


SIGN UP tOGIN MY SETT 


Untitled 

BY: AGUEST | DEC 31ST, 2011 | SYNTAX: NONE | SIZE: 71.51 KB | HITS: 2,862 1 EXPIRES: NEVER 
COPY TO CLIPBOARD | DOWNLOAD | RAW | EMBED | REPORT ABUSE 


‘Hi iif.n' 


iwOiiiRmflfttllL ^ And rechameiesS 



J$l - 

>- *' 4?v% 



1. Hello comrades and thanks for joining us for the final phase of our cross 

2. country hacker crime spree, our contribution to pr0j3kt m4yh3m. We're still 

3. preparing the torrents, mail spools, as well as our final txt zine release which 

4. will surely bring humiliation and embarrassment to many white hats and 

5. sysadmins. But this New Years Eve, we bringing yall some party favors to keep 

6. you raging all night. Did you remember a month ago when the mayors and piggies 

7. across the US conspired to attack protesters in public parks? We sure do, so we 

8. have been planning a retaliatory raid of our own. Bring it, NDAA. Bring it, 

9. SOPA. We are snipers with one hell of a scope! Takin out a cop or two, they 

10. can't cope with us! 

11 . 

12. west coast - east coast 

13. 

14. /******************************************************************************* 

15. CALIFORNIA LAW ENFORCEMENT ASSOCIATION - DEFACED AND DESTROYED BY ANTISEC 

16. ***************************************************************************★*★*/ 

17. 

18. Soundtrack to the Rev Track: The Coup - Five Million Ways to Kill a CEO 

19. http://www.youtube,com/watch?v=lJotps9V4as 

20 . 

21. I'm from the land where the Panthers grew 

22. You know the city and the avenue 

23. If you the boss we be smabbin through 

24. And we'll be grabbin* you 

25. To say "What's up with the revenue?" 

26. 

27. Most everybody already knows that we don't like police very much. Shit, just 

28. about everybody hates them, everybody except for the rich and powerful who 

29. depend on their protection. But which state got the most blood on their hands? 

30. Well we already owned pigs in Texas and Arizona, and many many others; guess its 

31. time to ride on the California police. 

32. 

33. From the murder of Oscar Grant, the repression of the occupation movement, the 

34. assassination of George Jackson in San Quinten prison, the prosecution of our 

35. anonymous comrades in San Jose, and the dehumanizing conditions in California 

36. jails and prisons today, California police have a notorious history of brutality 

37. and therefore have been on our hitlist for a good minute now. 

38. 
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39. So we went ahead and owned the California State Law Enforcement Association 

40. (CSLEA.COM), defacing their website and giving out live backdoors. We dumped a 

41. few of their mail spools and forum databases, and we did get a few laughs out of 

42. reading ye ars of their private email correspondence (such as CSLEA's Legisl ative 


43. and Police 

44. 


But what we were really after was their membership rosters, which 
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Hello comrades and thanks for joining us for the final phase of our cross count - Pastebin.com 

included the cleartext passworcWw 2500 of their members, guaranteeing the 
ownage of many more California pigs to come. 

"But wait! Cops are people too! Part of the 99%1" orly? When these soulless 
traitors voluntarily chose to cross the picket line and side with the bosses and 
bureaucrats, they burned all bridges with working class. As the bootboys for 
capitalism they do not protect us, instead choosing to serve the interests and 
assets of the rich ruling class, the 1%. Many Occupiers are learning what many 
of us already know about the role of police in society when they violently 
attacked protesters occupying public parks. Now it’s time to turn the table and 
start firing shots off in the right direction. Problem, officer? 


Interestingly, CSLEA members have discussed some of our previous hacks against 
police targets, raising concern for the security of their own systems. However 
| [ deliberately made some rather amusing lies as to their security. He 
repeatedly denied having been hacked up until web hosts at | | showed him 

some of the backdoors and other evidence of having dumped their databases. We 
were reading their entire email exchange including when they realized that 
credit card and password information was stored in cleartext. This is about the 
time l ~~b hanged his email password, but not before receiving a copy of the 
'shopper' table which contained all the CCs. Too lateJ I 


In all fairness, they did make an effort to secure their systems after discovery 

of the breach.l ” "" —— -- _____ - . . """I 



But we still had | | and were stealthily checking out the 

many other websites on the server, while also helping ourselves to thousands of 
police usernames and passwords (it's how Special Agent |~ | at the 

California DOJ fc nit got humiliated last month). For two months, we 

passed around their private password list amongst our black hat comrades like it 
was a fat blunt of the dank shit, and now it's time to dump that shit for the 
world to use and abuse. Did you see that there were hundreds of @doj.ca.gov 
passwords? Happy new years!! 


/******************************************************************************* 
LIST OF SITES HOSTED BY CSLEA, NOW WIPED OFF THE NET !!! 
*******************************************************************************/ 


Association of Conservation Employees (ACE) 

Association of Criminalists-DOJ (AC-DOJ) 

Association of Deputy Commissioners (ADC) 

Association of Motor Carrier Operations Specialists (AMCOS) 

Association of Motor Vehicle Investigators of California (AMVIC) 
Association of Special Agents-DOJ (ASA-DOJ) 

California Association of Criminal Investigators (CACI) 

California Association of Food and Drug Investigators (CAFDI) 

California Association of Fraud Investigators (CAFI) 

California Association of Regulatory Investigators and Inspectors (CARII) 
California Association of State Investigators (CASI) 

California Organization of Licensing Registration Examiners (COLRE) 
California Association of Law Enforcement Employees (CALEE) 

California Highway Patrol Public Safety Dispatchers Association (CHP-PSDA) 
Fire Marshal and Emergency Services Association (FMESA) 

Hospital Police Association of California (HPAC) 


pastebin.com/MSaBvt9R 


2/25 



















1/5/12 


Hello comrades and thanksjor joining us for the final phase of our cross count - Pastebin.com 



.244. 

.245. 

.246. 

.247. 

.248. 

.249. 

.250. 

.251. 

.252. 

.253. 

.254. 

.255. 

.256. 

.257. 


/******************************************************************************* 


mn | | yc 


L0L0L0L SO MUCH FOR "ENCRYPTED MEMBER DATA". DAMNl frOU DID HALF THE WORK 
FOR US. AND DESPITE BEING AWARE OF THE BREACH, YOU STILL COULD NOT KEEP US OUT. 
ON TO THE NEXT TARGET.... NEW YORK POLICE CHIEFS, OWNED AND EXPOSED 111 
*******************************************************************************/ 


Soundtrack to the Rev #3: Cop Killer by Ice-T 

http://www.youtube.com/watch7v=p5gRIud5 7 j Q 

I got my black shirt on. 

I got my black gloves on. 

I got my ski mask on. 

This shit's been too long. 


.258. I got my twelve gauge sawed off. 

.259. I got my headlights turned off. 

.260. I'm 'bout to bust some shots off. 

.261. I'm 'bout to dust some cops off. 

.262. 

.263. I'm a cop killer, better you than me. 

.264. Cop killer, fuck police brutality: 

.265. Cop killer, I know your family’s grieving, (fuck ’ernl) 

.266. Cop killer, but tonight we get even, ha ha. 

.267. 


.268. For our next owning we bring you multiple law enforcement targets in the state 
.269. of New York, who has been on our crosshairs for some time due to their brutal 
.270. repression of Occupy Wall Street. We also want to bring attention to the 1971 
.271. riots at Attica where in response to the murder of George Jackson, convicts took 
.272. over the priso, demanding humane living conditions. It is in this same spirit of 
.273. cross-country solidarity that we attacked police targets in NY. 

.274. 


.275. We’re dropping the md5-hashed passwords and residential addresses for over 300 
.276. Police Chiefs in the state of New York. We are also sharing several private mail 
.277. spools of a few NY police chiefs. While most of the contents of these emails 
.278. involve boring day to day office work and blonde joke chain emails, there were 
.279. also treasure troves of embarrassing personal information as well as several 
.280. "For Official Use Only" and "Law Enforcement Sensitive" documents discussing 
.281. police methods to combat protesters. 

.282. 


.283. Subject: Mid Hudson Chiefs Fwd: Demonstrators 
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Hello comrades and thanks for joining us for the final phase of our cross count - Pastebin.com 


346. There were also many parolee/probationers but the thought of betraying our 

347. comrades under the gun of the prison industrial complex never crossed our minds. 

348. But how about sum moar private police documents?? We dropped these on Bradley 

349. Manning's birthday: 
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Title: UNSUB(S); 

#ANTISEC; 


COMPUTER INTRUSION 


D- VICTIM; 


Synopsis: Close captioned investigation. 

Details: On November 18, 2011, retired California.Depart ment of 

Justice Special Agent SupervisnrI Iadvised 

that he received text messages from his own Google telephone 
number indicating that he had been "owned". 

On November 18, 2011, a YouTube video was posted with 
the title "#AntiSec Fuck FBI Friday V - Cybercrime Investigator 
Communications" from the YouTube user account 
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f ~l The video was 6:03 long and stated the 

following information, which was also posted as text below the 
video: 

"Greetings Pirates, and welcome to another exciting #FuckFBIFriday release. 

As part of our ongoing effort to expose and humiliate our white hat enemies, we targeted a Special Agent Supervisor 
of the CA Department of Justice in charge o J I We are leaking over 38,000 private 

emails which contain detailed computer forensics techniques, investigation protocols as well as highly embarrassing 
personal information. We are confident these gifts will bring smiles to the faces of our black hat brothers and sisters 
(especially those who have been targeted by these scurvy dogs) while also making a mockery of "security 
professionals" who whore their "skills" to law enforcement to protect tyrannical corporativism and the status quo we 
aim to destroy. 


UNCLASSIFIED 
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To: San Diego From: San Diego 

Re: 288A-SD-73148, 01/26/2012 


We hijacked two gmail accounts belonging tcf 


I who has been a cop foi| I years, dumping his privat e 

email correspondence as well as se veral dozen voicemails and SMS text message lo gs. While just yesterday|_| 

was having a private BBQ with his l I friends, we were reviewing their 

detailed internal operation plans and proc edure d ocuments. We also couldn't overlook the boatloa ds of embarrass ing 
personal information about our cop friendl Iwe lulzed as we listened to angry voicemails fronj_ 


~| We turned on his google web history and watched him look up l -■ [ 

] We also abused his google voice account, making surel friends 


and family knew how hard he was owned. Pos sibly the most interesting content in his emails are the 
internal email list archives (2005-2011) which[ 


[ 


I 


]The information in these emails will prove essential to 


those who want to protect themselves from the techniques and procedures cyber crime investigators use to build 
cases. If you have ever been bust ed for computer crimes, you should check to see if your case is being discussed 
here. There are discussions aboutl I 


These cybercrime investigators are supposed to be the cream of the crop, but we reveal the totality of their ignorance 
of all matters related to computer security. For months, we have owned several dozen white hat and law enforcement 
targets-- getting in and out of whichever high profile government and corporate system we please and despite all the 
active FBI investigations and several billion dollars of funding, they have not been able to stop us or get anywhere 
near us. Even worse, they bust a few dozen people wh o are allegedly p art of an "anonymous computer hacking 
conspiracy” but who have only used kindergarten-level] this isn't even hacking, but a form of electronic 

civil disobedience. 
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We often hear these "professionals" preach about "full-disclosure," but we are sure these people are angrily sending 
out DMCA takedown notices and serving subpoenas as we speak. They call us criminals, script kiddies, and 
terrorists, but their entire livelihood depends on us, trying desperately to study our techniques and failing miserably 
at preventing future attacks. See we're cut from an entirely different kind of cloth. Corporate security professionals 
like Thomas Ryan and Aaron Barr think they're doing something noble by "leaking" the public email discussion lists 
of Occupy Wall Street and profiling the "leaders" of Anonymous. Wannabe player haters drop shitty dox and leak 
partial chat logs about other hackers, doing free work for law enforcement. Then you got people like Peiter "Mudge" 
Zatko who back in the day used to be old school lOpht/cDc only now to sell out to DARPA going around to hacker 
conventions encouraging others to work for the feds. Let this be a warning to aspiring white hat "hacker" sellouts and 
police collaborators: stay out the game or get owned and exposed. You want to keep mass arresting and brutalizing 
the 99%? We'll have to keep owning your boxes and torrenting your mail spools, plastering your personal 
information all over teh internets. 


Hackers, join us and rise up against our common oppressors - the white hats, the 1%'s 'private' police, the corrupt 
banks and corporations and make 2011 the year of leaks and revolutions! 

We are Anti-Security, 

We are the 99% 

We do not forgive. 

We do not forget. 

Expect Us!" 
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San Diego From: San Diego 
288A-SD-73148, 01/26/2012 


A link was also provi ded on the YouTube page to the 
documents that were taken from account. The 


additionally, some of t 
account was posted at 


:ained within 



On November 30, 2011, California Department of Justice 
he FB I with a CD-ROM disc containing the files located 
These files are contained in a 1-A envelope to 
and are password protected with the following password 


responded to a Grand Jury 




lack of 


closed. 


Due to all victim information being destroyed and th e 


_San Diego requests that captioned investigation be 
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